Malware Analysis Report

2025-03-15 05:47

Sample ID 240623-1gh4wawgpq
Target 01496eb6ec65b46f3c3ce530bfad5cda_JaffaCakes118
SHA256 d70c69e53d36553d96628d020d3c6d87cbe7ab7c3a3ef1c17c40e1dd76efbd4f
Tags
upx aspackv2
score
7/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
7/10

SHA256

d70c69e53d36553d96628d020d3c6d87cbe7ab7c3a3ef1c17c40e1dd76efbd4f

Threat Level: Shows suspicious behavior

The file 01496eb6ec65b46f3c3ce530bfad5cda_JaffaCakes118 was found to be: Shows suspicious behavior.

Malicious Activity Summary

upx aspackv2

ASPack v2.12-2.42

Loads dropped DLL

Executes dropped EXE

UPX packed file

AutoIT Executable

Enumerates physical storage devices

Unsigned PE

Kills process with taskkill

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of WriteProcessMemory

Suspicious use of SendNotifyMessage

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-06-23 21:37

Signatures

ASPack v2.12-2.42

aspackv2
Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-23 21:37

Reported

2024-06-23 21:39

Platform

win10v2004-20240611-en

Max time kernel

150s

Max time network

149s

Command Line

"C:\Users\Admin\AppData\Local\Temp\01496eb6ec65b46f3c3ce530bfad5cda_JaffaCakes118.exe"

Signatures

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\aids.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

AutoIT Executable

Description Indicator Process Target
N/A N/A N/A N/A

Enumerates physical storage devices

Kills process with taskkill

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\aids.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\aids.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\aids.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\aids.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\aids.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\aids.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 544 wrote to memory of 4344 N/A C:\Users\Admin\AppData\Local\Temp\01496eb6ec65b46f3c3ce530bfad5cda_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 544 wrote to memory of 4344 N/A C:\Users\Admin\AppData\Local\Temp\01496eb6ec65b46f3c3ce530bfad5cda_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 544 wrote to memory of 4344 N/A C:\Users\Admin\AppData\Local\Temp\01496eb6ec65b46f3c3ce530bfad5cda_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 4344 wrote to memory of 4312 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 4344 wrote to memory of 4312 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 4344 wrote to memory of 4312 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 4344 wrote to memory of 2168 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\aids.exe
PID 4344 wrote to memory of 2168 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\aids.exe
PID 4344 wrote to memory of 2168 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\aids.exe
PID 2168 wrote to memory of 1172 N/A C:\Users\Admin\AppData\Local\aids.exe C:\Windows\SysWOW64\cmd.exe
PID 2168 wrote to memory of 1172 N/A C:\Users\Admin\AppData\Local\aids.exe C:\Windows\SysWOW64\cmd.exe
PID 2168 wrote to memory of 1172 N/A C:\Users\Admin\AppData\Local\aids.exe C:\Windows\SysWOW64\cmd.exe
PID 1172 wrote to memory of 5100 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 1172 wrote to memory of 5100 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 1172 wrote to memory of 5100 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe

Processes

C:\Users\Admin\AppData\Local\Temp\01496eb6ec65b46f3c3ce530bfad5cda_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\01496eb6ec65b46f3c3ce530bfad5cda_JaffaCakes118.exe"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~3846.bat "C:\Users\Admin\AppData\Local\Temp\01496eb6ec65b46f3c3ce530bfad5cda_JaffaCakes118.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "01496eb6ec65b46f3c3ce530bfad5cda_JaffaCakes118.exe"

C:\Users\Admin\AppData\Local\aids.exe

"C:\Users\Admin\AppData\Local\aids.exe" "01496eb6ec65b46f3c3ce530bfad5cda_JaffaCakes118.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c taskkill /f /im aids.exe & del /f /q "C:\Users\Admin\AppData\Local\aids.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im aids.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
US 8.8.8.8:53 149.220.183.52.in-addr.arpa udp
US 8.8.8.8:53 37.56.20.217.in-addr.arpa udp
US 8.8.8.8:53 71.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
US 8.8.8.8:53 232.168.11.51.in-addr.arpa udp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 92.12.20.2.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 13.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 10.27.171.150.in-addr.arpa udp
US 8.8.8.8:53 udp

Files

C:\Users\Admin\AppData\Local\Temp\~3846.bat

MD5 e8995b3d76851b9a2f7031e01819fa4c
SHA1 b6fa25e97525ddab025500f63f0123c899675c4b
SHA256 d2b62b4c6c655f8fc1d80bc3214c803f95dfb1232a1528c505df46f53c233354
SHA512 dadcfcd1265d234f7ec0b295e32f5e19a5289726fb710b6d34085430145cd4d60058817d23f81596985d4a45be142c8e24e560d968f28cb1d10802cec7302b8b

memory/544-12-0x0000000000400000-0x00000000009AA000-memory.dmp

C:\Users\Admin\AppData\Local\aids.exe

MD5 4e0e5006f1c03669c25926dcc3a509e9
SHA1 3323bdca98f17dd0f07dadd5bb2fde25994164b1
SHA256 1ab4d0c338932cae0d08a888cb42c85c37165db3525476da07db9a8b6505830a
SHA512 3bab42e065a008a94eb7977c6ef37aeaaf41190018decaeae366750ccf69f2ffea35ddeead0156ec42d9ee5184bdc6a3534ba979de0099ee35e65b7ca71a5375

memory/2168-16-0x0000000000400000-0x00000000004B4000-memory.dmp

memory/2168-17-0x0000000000400000-0x00000000004B4000-memory.dmp

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-23 21:37

Reported

2024-06-23 21:39

Platform

win7-20240419-en

Max time kernel

122s

Max time network

123s

Command Line

"C:\Users\Admin\AppData\Local\Temp\01496eb6ec65b46f3c3ce530bfad5cda_JaffaCakes118.exe"

Signatures

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\aids.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

AutoIT Executable

Description Indicator Process Target
N/A N/A N/A N/A

Enumerates physical storage devices

Kills process with taskkill

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\aids.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\aids.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\aids.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\aids.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\aids.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\aids.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1576 wrote to memory of 3008 N/A C:\Users\Admin\AppData\Local\Temp\01496eb6ec65b46f3c3ce530bfad5cda_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 1576 wrote to memory of 3008 N/A C:\Users\Admin\AppData\Local\Temp\01496eb6ec65b46f3c3ce530bfad5cda_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 1576 wrote to memory of 3008 N/A C:\Users\Admin\AppData\Local\Temp\01496eb6ec65b46f3c3ce530bfad5cda_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 1576 wrote to memory of 3008 N/A C:\Users\Admin\AppData\Local\Temp\01496eb6ec65b46f3c3ce530bfad5cda_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 3008 wrote to memory of 2576 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 3008 wrote to memory of 2576 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 3008 wrote to memory of 2576 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 3008 wrote to memory of 2576 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 3008 wrote to memory of 2588 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\aids.exe
PID 3008 wrote to memory of 2588 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\aids.exe
PID 3008 wrote to memory of 2588 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\aids.exe
PID 3008 wrote to memory of 2588 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\aids.exe
PID 2588 wrote to memory of 2496 N/A C:\Users\Admin\AppData\Local\aids.exe C:\Windows\SysWOW64\cmd.exe
PID 2588 wrote to memory of 2496 N/A C:\Users\Admin\AppData\Local\aids.exe C:\Windows\SysWOW64\cmd.exe
PID 2588 wrote to memory of 2496 N/A C:\Users\Admin\AppData\Local\aids.exe C:\Windows\SysWOW64\cmd.exe
PID 2588 wrote to memory of 2496 N/A C:\Users\Admin\AppData\Local\aids.exe C:\Windows\SysWOW64\cmd.exe
PID 2496 wrote to memory of 2792 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 2496 wrote to memory of 2792 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 2496 wrote to memory of 2792 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 2496 wrote to memory of 2792 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe

Processes

C:\Users\Admin\AppData\Local\Temp\01496eb6ec65b46f3c3ce530bfad5cda_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\01496eb6ec65b46f3c3ce530bfad5cda_JaffaCakes118.exe"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~1CB4.bat "C:\Users\Admin\AppData\Local\Temp\01496eb6ec65b46f3c3ce530bfad5cda_JaffaCakes118.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im "01496eb6ec65b46f3c3ce530bfad5cda_JaffaCakes118.exe"

C:\Users\Admin\AppData\Local\aids.exe

"C:\Users\Admin\AppData\Local\aids.exe" "01496eb6ec65b46f3c3ce530bfad5cda_JaffaCakes118.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c taskkill /f /im aids.exe & del /f /q "C:\Users\Admin\AppData\Local\aids.exe"

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im aids.exe

Network

N/A

Files

C:\Users\Admin\AppData\Local\Temp\~1CB4.bat

MD5 e8995b3d76851b9a2f7031e01819fa4c
SHA1 b6fa25e97525ddab025500f63f0123c899675c4b
SHA256 d2b62b4c6c655f8fc1d80bc3214c803f95dfb1232a1528c505df46f53c233354
SHA512 dadcfcd1265d234f7ec0b295e32f5e19a5289726fb710b6d34085430145cd4d60058817d23f81596985d4a45be142c8e24e560d968f28cb1d10802cec7302b8b

C:\Users\Admin\AppData\Local\aids.exe

MD5 4e0e5006f1c03669c25926dcc3a509e9
SHA1 3323bdca98f17dd0f07dadd5bb2fde25994164b1
SHA256 1ab4d0c338932cae0d08a888cb42c85c37165db3525476da07db9a8b6505830a
SHA512 3bab42e065a008a94eb7977c6ef37aeaaf41190018decaeae366750ccf69f2ffea35ddeead0156ec42d9ee5184bdc6a3534ba979de0099ee35e65b7ca71a5375

memory/2588-17-0x0000000000400000-0x00000000004B4000-memory.dmp

memory/3008-16-0x0000000000130000-0x00000000001E4000-memory.dmp

memory/1576-12-0x0000000000400000-0x00000000009AA000-memory.dmp

memory/2588-19-0x0000000000400000-0x00000000004B4000-memory.dmp